Keycloak 26.4.1 — Release Notes & Engineering Impact

<div> <h2>Upgrading</h2> <p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/#migration-changes">the migration guide</a> for a complete list of changes.</p> <h2>All resolved issues</h2> <h3>New features</h3> <ul> <li><a href="https://github.com/keycloak/keycloak/issues/43020">#43020</a> Secure Client-Initiated Renegotiation - disable by default <code>dist/quarkus</code></li> </ul> <h3>Enhancements</h3> <ul> <li><a href="https://github.com/keycloak/keycloak/issues/42990">#42990</a> Hide read-only email attribute in update profile context with update email enabled <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/43357">#43357</a> JDBC_PING should publish its physical address on startup </li> </ul> <h3>Bugs</h3> <ul> <li><a href="https://github.com/keycloak/keycloak/issues/40965">#40965</a> Group permission denies to view user <code>admin/fine-grained-permissions</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/41292">#41292</a> openid-connect flow is missing response type on language change <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/42565">#42565</a> Standard Token Exchange: chain of exchanges eventually fails <code>token-exchange</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/42676">#42676</a> Security Defenses realm settings lost when switching between Headers and Brute Force Detection tabs (v25+) <code>admin/ui</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/42907">#42907</a> Race condition in authorization service leads to NullPointerException when evaluating permissions during concurrent resource deletion <code>authorization-services</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/43042">#43042</a> Avoid NPE in FederatedJWTClientAuthenticator when checking for supported assertion types <code>core</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/43070">#43070</a> Update email page with pending verification email messages prefilled with old email <code>user-profile</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/43096">#43096</a> keycloak-operator 26.4.0 missing clusterrole permissions <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/43104">#43104</a> Release notes fix for update email <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/43161">#43161</a> Restarting an user session broken for persistent sessions <code>infinispan</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/43164">#43164</a> Keycloak docs state that only TLSv1.3 is used <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/43218">#43218</a> Cannot revoke access token generated by Standard Token Exchange <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/43254">#43254</a> Make sure username and email attributes are lower cased when fetching their values from LDAP object <code>ldap</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/43269">#43269</a> Keycloak 26.4 returns a different error response on a token request without Client Assertion (private_key_jwt client authentication) from Keycloak 26.3 does <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/43270">#43270</a> Keycloak 26.4 returns a different error response on a CIBA backchannel authentication request without Client Assertion (private_key_jwt client authentication) from Keycloak 26.3 does <code>oidc</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/43286">#43286</a> Broken links on DB server configuration guide <code>docs</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/43304">#43304</a> SAML Client - Encrypt assertions toggle shows wrong dialog text (Client signature required) <code>saml</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/43328">#43328</a> "Remember me" user sessions remain valid after "remember me" realm setting is disabled <code>authentication</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/43335">#43335</a> First JDBC_PING initialization happens in the JTA transaction context <code>infinispan</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/43349">#43349</a> Client session may be lost during session restart <code>infinispan</code></li> <li><a href="https://github.com/keycloak/keycloak/issues/43394">#43394</a> SPIFFE client authentication does not work when JWT SVID includes `iss` claim </li> <li><a href="https://github.com/keycloak/keycloak/issues/43459">#43459</a> Invalid YAML in advanced Operator configurations <code>docs</code></li> </ul> </div>